Loading HuntDB...

Session Doesn't expire after 2fa and also other session can change passsword

Low
S
SideFX
Submitted None
Reported by 0xchoudhary

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
## Summary: Hi team, I found one issue related to your 2FA system on https://sidefx.com ## Steps To Reproduce: Login to the Same account in 2 different browser Now on 1st browser go to https://sidefx.com/profile and complete the all steps of 2fa and Enable it | 2FA activated Now go to another session or 2nd browser and reload the page. The account doesn't logout session is still alive. and now change the password on 2nd browser (which doesn't have 2fa enabled) BOOM! ## Impact In this scenario when 2FA is activated the other sessions of the account are not invalidated. 2FA is required to login. I believe the expected and recommended behavior here is to terminate the other sessions> request a new login> request the 2FA code> so then give the account access again

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Access Control - Generic